Last updated: 27 October 2026
StormDoor is run by Tofu Lab AB (org.nr 559460-9942), Stockholm, Sweden. Contact: hello@stormdoor.dev. A street address will be added here before paid signups open.
Our role
For the website, the waitlist and console accounts, we are the controller. For content that a customer sends through the API, the customer is the controller and we are the processor: we process it on their instructions to return a result, and for nothing else.
What you send to the gates
We do not store what you send to a gate, and we do not store the result we return. This applies to the API and to the free tools on this website. Each request is processed to produce the result and then discarded; it is not written to a database, to files or to logs. For billing and rate limits we may record that a call was made (which gate, when, credits used), never what it contained or what it returned.
Checks may use the domain from your input to query public internet services, and a link check contacts the link’s destination.
For API content, the customer decides what to send and must have a lawful basis for it. Our terms prohibit special-category data unless agreed separately. A data processing agreement (GDPR Art. 28) is available on request at hello@stormdoor.dev. If we become aware of a personal-data breach affecting your content, we tell you without undue delay.
Website visitors and free tools
We use your IP address to rate-limit the free tools and the waitlist form, to prevent abuse (legitimate interest). It is not stored.
Analytics
We measure how the website and the free tools are used (pages viewed, whether a check was run and its verdict) with a product-analytics service hosted in the EU. It uses no cookies or browser storage, and IP addresses are anonymised. Events contain no content you enter: not the text or addresses you check, not the results, and not anything you type into the waitlist form (we record only that it was submitted and whether it went through). Page addresses are recorded without query strings or fragments, and the waitlist confirmation and unsubscribe pages are not measured at all. The legal basis is legitimate interest (understanding and improving the service). The service provider receives this data as an analytics provider.
Waitlist
Data. Your email address, your answer to “what would you use it for?” and any note, the consent text you saw, and the times you signed up, confirmed or unsubscribed.
Why and basis. To email you when signups open, on your consent, given by confirming through the link in the confirmation email.
Bot check. When you submit the form, an automated bot check runs. It processes your IP address and technical browser signals to tell people from bots, and for no other purpose. The basis is our legitimate interest in preventing abuse.
How long. Unconfirmed signups are deleted after 30 days. Confirmed signups are deleted 6 months after signups open, unless you sign up for an account by then, or earlier if you unsubscribe or ask us to erase the record. Every email has an unsubscribe link.
Console accounts
Data. Your email address, your workspace and role, invitations, sign-in sessions, one-time login codes, API token details (name, plan, usage times; the token itself is stored in hashed form), and your IP address in login abuse-protection records.
Why and basis. To provide the console and API access: performance of the contract with your workspace. For members invited by someone else, our legitimate interest in letting workspaces manage their own access. Abuse protection is our legitimate interest in keeping sign-in secure.
How long. For the life of the account; we delete an account on request within 30 days. Login abuse-protection records are deleted after 24 hours.
Cookies
The website sets no cookies and uses no browser storage for analytics. The console sets one session cookie after you sign in, which is needed for it to work.
Who receives data
Hosting and infrastructure providers, email delivery providers, a security (bot-protection) provider and an analytics provider process data on our behalf. For API content, it is processed by us and the sub-processors listed in our data processing agreement, available on request.
Transfers
Data is processed in the EU. Where a provider may process data outside the EU, appropriate safeguards such as the EU standard contractual clauses apply.
Security
Traffic is encrypted in transit, access to data is limited to those who need it, and credentials are stored in hashed form. We hold no security certifications.
Your rights
You can ask for access to, correction of, erasure of or restriction of your personal data, object to processing based on legitimate interest, and ask for a portable copy. Email hello@stormdoor.dev; we answer within one month. For content a customer sent through the API, contact that customer. You can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se) or your local supervisory authority.
Children
The services are for businesses and developers, not children. If a child has given us personal data, email us and we will delete it.
Changes
We update this page when things change and keep the date above current. We email customers about material changes.